CVE-2022-42735

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu.

ShenYu Admin allows low-privilege low-level administrators create users with higher privileges than their own.

This issue affects Apache ShenYu: 2.5.0.

Upgrade to Apache ShenYu 2.5.1 or apply patch https://github.com/apache/shenyu/pull/3958 https://github.com/apache/shenyu/pull/3958 .

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Feb 15, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-42749.8A vulnerability, which was classified as critical, was found in House Rental System. Affected is an unknown function of the file /view-propeCVE-2022-427435.3deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the applicatiCVE-2022-427449.8CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the apCVE-2022-427457.5CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulCVE-2022-427466.1CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This CVE-2022-427476.1CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is CVE-2022-427486.1CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. TCVE-2022-427496.1CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is poCVE-2022-42759.8A vulnerability has been found in House Rental System and classified as critical. Affected by this vulnerability is an unknown functionalityCVE-2022-427508.8CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does noCVE-2022-427518.8CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffeCVE-2022-427536.1SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not
CVE-2022-42735: High severity, CVSS 8.8 | Vulnix